Skip to content

Commit a11e1c6

Browse files
stoneshi-yunifystoneshi-yunify
authored
Merge pull request #1057 from stoneshi-yunify/master
support kubeconfig saving type
2 parents da6bd1d + cc20187 commit a11e1c6

File tree

8 files changed

+70
-105
lines changed

8 files changed

+70
-105
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 33 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
tag:
77
description: "Image Tag"
88
default: "latest"
9+
pull_request:
10+
branches:
11+
- master
912
push:
1013
branches:
1114
- master
@@ -41,58 +44,40 @@ jobs:
4144
echo ::set-output name=version::${VERSION}
4245
- name: Docker meta for kubesphere
4346
id: meta
44-
uses: docker/metadata-action@v3
47+
uses: docker/metadata-action@v5
4548
with:
4649
images: |
4750
kubesphere/devops-controller
4851
tags: ${{ steps.prepare.outputs.version }}
4952
- name: Set up QEMU
50-
uses: docker/setup-qemu-action@v1
53+
uses: docker/setup-qemu-action@v3
5154
- name: Set up Docker Buildx
52-
uses: docker/setup-buildx-action@v1
55+
uses: docker/setup-buildx-action@v3
5356
- name: Login to DockerHub
54-
if: github.event_name != 'pull_request'
55-
uses: docker/login-action@v1
57+
uses: docker/login-action@v3
5658
with:
5759
username: ${{ secrets.DOCKER_HUB_USER }}
5860
password: ${{ secrets.DOCKER_HUB_SECRETS }}
5961
- name: Build env
6062
id: build_env
6163
run: |
62-
if [ "${{ github.event_name }}" == "pull_request" ]
64+
if [ ${{ github.ref_type }} == "tag" ]
6365
then
64-
echo "::set-output name=platforms::linux/amd64"
65-
echo "::set-output name=push::false"
66-
echo "::set-output name=load::true"
67-
echo "::set-output name=ref::pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")"
68-
else
6966
echo "::set-output name=platforms::linux/amd64,linux/arm64"
70-
echo "::set-output name=push::true"
71-
echo "::set-output name=load::false"
72-
echo "::set-output name=ref::${{github.ref_name}}"
67+
else
68+
echo "::set-output name=platforms::linux/amd64"
7369
fi
70+
echo "::set-output name=push::true"
71+
echo "::set-output name=ref::${{github.ref_name}}"
7472
echo "::set-output name=short_sha::${GITHUB_SHA::7}"
7573
- name: Build and push Docker images
76-
uses: docker/build-push-action@v2.4.0
74+
uses: docker/build-push-action@v6
7775
with:
7876
file: config/dockerfiles/controller-manager/Dockerfile
7977
tags: ${{ steps.meta.outputs.tags }}
8078
push: ${{ steps.build_env.outputs.push }}
81-
load: ${{ steps.build_env.outputs.load }}
8279
labels: ${{ steps.meta.outputs.labels }}
8380
platforms: ${{ steps.build_env.outputs.platforms }}
84-
provenance: false
85-
sbom: false
86-
- name: Run Trivy vulnerability scanner
87-
uses: aquasecurity/[email protected]
88-
if: github.event_name == 'pull_request'
89-
with:
90-
image-ref: 'docker.io/kubesphere/devops-controller:${{ steps.build_env.outputs.ref }}-${{ steps.build_env.outputs.short_sha }}'
91-
format: 'table'
92-
exit-code: '1'
93-
ignore-unfixed: true
94-
vuln-type: 'os,library'
95-
severity: 'CRITICAL,HIGH'
9681

9782
BuildAPIServer:
9883
runs-on: ubuntu-latest
@@ -111,58 +96,40 @@ jobs:
11196
echo ::set-output name=version::${VERSION}
11297
- name: Docker meta for kubesphere
11398
id: meta
114-
uses: docker/metadata-action@v3
99+
uses: docker/metadata-action@v5
115100
with:
116101
images: |
117102
kubesphere/devops-apiserver
118103
tags: ${{ steps.prepare.outputs.version }}
119104
- name: Set up QEMU
120-
uses: docker/setup-qemu-action@v1
105+
uses: docker/setup-qemu-action@v3
121106
- name: Set up Docker Buildx
122-
uses: docker/setup-buildx-action@v1
107+
uses: docker/setup-buildx-action@v3
123108
- name: Login to DockerHub
124-
if: github.event_name != 'pull_request'
125-
uses: docker/login-action@v1
109+
uses: docker/login-action@v3
126110
with:
127111
username: ${{ secrets.DOCKER_HUB_USER }}
128112
password: ${{ secrets.DOCKER_HUB_SECRETS }}
129113
- name: Build env
130114
id: build_env
131115
run: |
132-
if [ "${{ github.event_name }}" == "pull_request" ]
116+
if [ ${{ github.ref_type }} == "tag" ]
133117
then
134-
echo "::set-output name=platforms::linux/amd64"
135-
echo "::set-output name=push::false"
136-
echo "::set-output name=load::true"
137-
echo "::set-output name=ref::pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")"
138-
else
139118
echo "::set-output name=platforms::linux/amd64,linux/arm64"
140-
echo "::set-output name=push::true"
141-
echo "::set-output name=load::false"
142-
echo "::set-output name=ref::${{github.ref_name}}"
119+
else
120+
echo "::set-output name=platforms::linux/amd64"
143121
fi
122+
echo "::set-output name=push::true"
123+
echo "::set-output name=ref::${{github.ref_name}}"
144124
echo "::set-output name=short_sha::${GITHUB_SHA::7}"
145125
- name: Build and push Docker images
146-
uses: docker/build-push-action@v2.4.0
126+
uses: docker/build-push-action@v6
147127
with:
148128
file: config/dockerfiles/apiserver/Dockerfile
149129
tags: ${{ steps.meta.outputs.tags }}
150130
push: ${{ steps.build_env.outputs.push }}
151-
load: ${{ steps.build_env.outputs.load }}
152131
labels: ${{ steps.meta.outputs.labels }}
153132
platforms: ${{ steps.build_env.outputs.platforms }}
154-
provenance: false
155-
sbom: false
156-
- name: Run Trivy vulnerability scanner
157-
uses: aquasecurity/[email protected]
158-
if: github.event_name == 'pull_request'
159-
with:
160-
image-ref: 'docker.io/kubesphere/devops-apiserver:${{ steps.build_env.outputs.ref }}-${{ steps.build_env.outputs.short_sha }}'
161-
format: 'table'
162-
exit-code: '1'
163-
ignore-unfixed: true
164-
vuln-type: 'os,library'
165-
severity: 'CRITICAL,HIGH'
166133

167134
BuildTools:
168135
runs-on: ubuntu-latest
@@ -181,55 +148,37 @@ jobs:
181148
echo ::set-output name=version::${VERSION}
182149
- name: Docker meta for kubesphere
183150
id: meta
184-
uses: docker/metadata-action@v3
151+
uses: docker/metadata-action@v5
185152
with:
186153
images: |
187154
kubesphere/devops-tools
188155
tags: ${{ steps.prepare.outputs.version }}
189156
- name: Set up QEMU
190-
uses: docker/setup-qemu-action@v1
157+
uses: docker/setup-qemu-action@v3
191158
- name: Set up Docker Buildx
192-
uses: docker/setup-buildx-action@v1
159+
uses: docker/setup-buildx-action@v3
193160
- name: Login to DockerHub
194-
if: github.event_name != 'pull_request'
195-
uses: docker/login-action@v1
161+
uses: docker/login-action@v3
196162
with:
197163
username: ${{ secrets.DOCKER_HUB_USER }}
198164
password: ${{ secrets.DOCKER_HUB_SECRETS }}
199165
- name: Build env
200166
id: build_env
201167
run: |
202-
if [ "${{ github.event_name }}" == "pull_request" ]
168+
if [ ${{ github.ref_type }} == "tag" ]
203169
then
204-
echo "::set-output name=platforms::linux/amd64"
205-
echo "::set-output name=push::false"
206-
echo "::set-output name=load::true"
207-
echo "::set-output name=ref::pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")"
208-
else
209170
echo "::set-output name=platforms::linux/amd64,linux/arm64"
210-
echo "::set-output name=push::true"
211-
echo "::set-output name=load::false"
212-
echo "::set-output name=ref::${{github.ref_name}}"
171+
else
172+
echo "::set-output name=platforms::linux/amd64"
213173
fi
174+
echo "::set-output name=push::true"
175+
echo "::set-output name=ref::${{github.ref_name}}"
214176
echo "::set-output name=short_sha::${GITHUB_SHA::7}"
215177
- name: Build and push Docker images
216-
uses: docker/build-push-action@v2.4.0
178+
uses: docker/build-push-action@v6
217179
with:
218180
file: config/dockerfiles/tools/Dockerfile
219181
tags: ${{ steps.meta.outputs.tags }}
220182
push: ${{ steps.build_env.outputs.push }}
221-
load: ${{ steps.build_env.outputs.load }}
222183
labels: ${{ steps.meta.outputs.labels }}
223184
platforms: ${{ steps.build_env.outputs.platforms }}
224-
provenance: false
225-
sbom: false
226-
- name: Run Trivy vulnerability scanner
227-
uses: aquasecurity/[email protected]
228-
if: github.event_name == 'pull_request'
229-
with:
230-
image-ref: 'docker.io/kubesphere/devops-tools:${{ steps.build_env.outputs.ref }}-${{ steps.build_env.outputs.short_sha }}'
231-
format: 'table'
232-
exit-code: '1'
233-
ignore-unfixed: true
234-
vuln-type: 'os,library'
235-
severity: 'CRITICAL,HIGH'

‎pkg/api/devops/v1alpha3/credential_types.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,19 +52,21 @@ const (
5252
// SSHAuthPrivateKey is the key of the privatekey for SecretTypeSSHAuth secrets
5353
SSHAuthPrivateKey = "private_key"
5454

55+
SecretTextString = "secret-text"
5556
// SecretTypeSecretText contains data.
5657
//
5758
// Required at least one of fields:
5859
// - Secret.Data["secret"] - secret
59-
SecretTypeSecretText v1.SecretType = DevOpsCredentialPrefix + "secret-text"
60+
SecretTypeSecretText v1.SecretType = DevOpsCredentialPrefix + SecretTextString
6061
// SecretTextSecretKey is the key of the secret for SecretTypeSecretText secrets
6162
SecretTextSecretKey = "secret"
6263

64+
KubeConfigString = "kubeconfig"
6365
// SecretTypeKubeConfig contains data.
6466
//
6567
// Required at least one of fields:
6668
// - Secret.Data["secret"] - secret
67-
SecretTypeKubeConfig v1.SecretType = DevOpsCredentialPrefix + "kubeconfig"
69+
SecretTypeKubeConfig v1.SecretType = DevOpsCredentialPrefix + KubeConfigString
6870
// KubeConfigSecretKey is the key of the secret for SecretTypeKubeConfig secrets
6971
KubeConfigSecretKey = "content"
7072
// CredentialAutoSyncAnnoKey is used to indicate whether the secret is automatically synchronized to devops.

‎pkg/client/devops/credential.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,4 +68,6 @@ type CredentialOperator interface {
6868
GetCredentialInProject(projectId, id string) (*Credential, error)
6969

7070
DeleteCredentialInProject(projectId, id string) (string, error)
71+
72+
GetKubeConfigCredentialStoreType() string
7173
}

‎pkg/client/devops/jclient/credential.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ func (j *JenkinsClient) CreateCredentialInProject(projectID string, credential *
2828
client := j.getClient()
2929

3030
var cre interface{}
31-
if cre, err = util.ConvertSecretToCredential(credential); err != nil {
31+
if cre, err = util.ConvertSecretToCredential(credential, j.SaveKubeConfigAs); err != nil {
3232
return "", err
3333
}
3434
return "", client.CreateInFolder(projectID, cre)
@@ -39,7 +39,7 @@ func (j *JenkinsClient) UpdateCredentialInProject(projectID string, credential *
3939
client := j.getClient()
4040

4141
var cre interface{}
42-
if cre, err = util.ConvertSecretToCredential(credential); err != nil {
42+
if cre, err = util.ConvertSecretToCredential(credential, j.SaveKubeConfigAs); err != nil {
4343
return "", err
4444
}
4545

@@ -58,6 +58,10 @@ func (j *JenkinsClient) DeleteCredentialInProject(projectID, id string) (string,
5858
return id, client.DeleteInFolder(projectID, id)
5959
}
6060

61+
func (j *JenkinsClient) GetKubeConfigCredentialStoreType() string {
62+
return j.SaveKubeConfigAs
63+
}
64+
6165
func (j *JenkinsClient) getClient() *jcredential.CredentialsManager {
6266
return &jcredential.CredentialsManager{JenkinsCore: j.Core}
6367
}

‎pkg/client/devops/jclient/credential_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func TestUpdateCredentialInProject(t *testing.T) {
7070
secret.SetName("id")
7171
secret.Type = devopsv1alpha3.SecretTypeBasicAuth
7272

73-
data, err := devopsutil.ConvertSecretToCredential(secret.DeepCopy())
73+
data, err := devopsutil.ConvertSecretToCredential(secret.DeepCopy(), devopsv1alpha3.KubeConfigString)
7474
assert.Nil(t, err)
7575

7676
formData := url.Values{}
@@ -108,7 +108,7 @@ func TestCreateCredentialInProject(t *testing.T) {
108108
unknownSecret := secret.DeepCopy()
109109
unknownSecret.Type = "fake"
110110

111-
data, err := devopsutil.ConvertSecretToCredential(secret.DeepCopy())
111+
data, err := devopsutil.ConvertSecretToCredential(secret.DeepCopy(), devopsv1alpha3.KubeConfigString)
112112
assert.Nil(t, err)
113113

114114
formData := url.Values{}

‎pkg/client/devops/jclient/jenkins.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,9 @@ import (
2525

2626
// JenkinsClient represents a client of Jenkins
2727
type JenkinsClient struct {
28-
Core core.JenkinsCore
29-
jenkins *jenkins.Jenkins // For refactor purpose only
28+
Core core.JenkinsCore
29+
SaveKubeConfigAs string
30+
jenkins *jenkins.Jenkins // For refactor purpose only
3031
}
3132

3233
var _ devops.Interface = &JenkinsClient{}
@@ -41,7 +42,8 @@ func NewJenkinsClient(options *jenkins.Options) (*JenkinsClient, error) {
4142

4243
devopsClient, _ := jenkins.NewDevopsClient(options) // For refactor purpose only
4344
return &JenkinsClient{
44-
Core: jenkinsCore,
45-
jenkins: devopsClient, // For refactor purpose only
45+
Core: jenkinsCore,
46+
jenkins: devopsClient, // For refactor purpose only
47+
SaveKubeConfigAs: options.SaveKubeConfigAs,
4648
}, nil
4749
}

‎pkg/client/devops/jenkins/options.go‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,22 +18,24 @@ package jenkins
1818

1919
import (
2020
"fmt"
21-
"github.com/kubesphere/ks-devops/pkg/utils/reflectutils"
2221
"time"
2322

23+
"github.com/kubesphere/ks-devops/pkg/utils/reflectutils"
24+
2425
"github.com/spf13/pflag"
2526
)
2627

2728
type Options struct {
28-
Host string `json:",omitempty" yaml:"host" description:"Jenkins service host address"`
29-
Username string `json:",omitempty" yaml:"username" description:"Jenkins admin username"`
30-
Password string `json:",omitempty" yaml:"password" description:"Jenkins admin password"`
31-
ApiToken string `json:"apiToken,omitempty" yaml:"apiToken" description:"Jenkins admin apiToken"`
32-
MaxConnections int `json:"maxConnections,omitempty" yaml:"maxConnections" description:"Maximum connections allowed to connect to Jenkins"`
33-
Namespace string `json:"namespace,omitempty" yaml:"namespace"`
34-
WorkerNamespace string `json:"workerNamespace,omitempty" yaml:"workerNamespace"`
35-
ReloadCasCDelay time.Duration `json:"reloadCasCDelay,omitempty" yaml:"reloadCasCDelay"`
36-
SkipVerify bool
29+
Host string `json:",omitempty" yaml:"host" description:"Jenkins service host address"`
30+
Username string `json:",omitempty" yaml:"username" description:"Jenkins admin username"`
31+
Password string `json:",omitempty" yaml:"password" description:"Jenkins admin password"`
32+
ApiToken string `json:"apiToken,omitempty" yaml:"apiToken" description:"Jenkins admin apiToken"`
33+
MaxConnections int `json:"maxConnections,omitempty" yaml:"maxConnections" description:"Maximum connections allowed to connect to Jenkins"`
34+
Namespace string `json:"namespace,omitempty" yaml:"namespace"`
35+
WorkerNamespace string `json:"workerNamespace,omitempty" yaml:"workerNamespace"`
36+
ReloadCasCDelay time.Duration `json:"reloadCasCDelay,omitempty" yaml:"reloadCasCDelay"`
37+
SkipVerify bool
38+
SaveKubeConfigAs string `json:"saveKubeConfigAs,omitempty" yaml:"saveKubeConfigAs"` // values: [secret-text, kubeconfig]. default is kubeconfig
3739
}
3840

3941
// NewJenkinsOptions returns a `zero` instance

‎pkg/client/devops/util/credential.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ import (
2727
)
2828

2929
// ConvertSecretToCredential converts a secret to Jenkins credential type
30-
func ConvertSecretToCredential(secret *v1.Secret) (interface{}, error) {
30+
func ConvertSecretToCredential(secret *v1.Secret, saveKubeConfigAs string) (interface{}, error) {
3131
name := secret.GetName()
3232

3333
switch secret.Type {
@@ -45,6 +45,10 @@ func ConvertSecretToCredential(secret *v1.Secret) (interface{}, error) {
4545
return jcredential.NewSecretTextCredential(name, secretContent), nil
4646
case devopsv1alpha3.SecretTypeKubeConfig:
4747
secretContent := string(secret.Data[devopsv1alpha3.KubeConfigSecretKey])
48+
// for backward compatibility, empty value means kubeconfig
49+
if saveKubeConfigAs == devopsv1alpha3.SecretTextString {
50+
return jcredential.NewSecretTextCredential(name, secretContent), nil
51+
}
4852
return jcredential.NewKubeConfigCredential(name, secretContent), nil
4953
default:
5054
err := fmt.Errorf("error unsupport credential type")

0 commit comments

Comments
 (0)